In this walk through, we will be going through the Cross Site Scripting Reflected (AJAX-XML) vulnerability section from bWAPP Labs. We will be exploring and exploiting Reflected Cross Scripting vulnerability in AJAX-XML implementations and learn how application are affected because of it. So, let’s get started with the Hacking without any delay.
Table of Contents
Security: Low
- Setting the security level to Low.
- The application has a search functionality where we can search for movies in the DB. It uses ajax to dynamically search the input.
- I used the below payload to check if the data is being stored in the DOM and is getting parsed however it did not work.
- Next, i encoded the same payload to HTML entities and it was parsed by the application this time.
<h1> Hello <h1> <h1> Hello <h1>
- Next, i used the below payload, encoded as HTML entities and got a pop-up in response.
<img src='#' onerror='alert(1)'> <img src='#' onerror='alert(1)'>
Security: Medium
- Setting the security level to Medium.
- I used the below payload again to check if it is still vulnerable and it worked.
<h1> Hello <h1> <h1> Hello <h1>
- Next, i used the below payload again, encoded as HTML entities and got a pop-up in response.
<img src='#' onerror='alert(1)'> <img src='#' onerror='alert(1)'>
- Not working the high level.
Also Read: bWAPP – Cross Site Scripting Reflected (Referrer)
Conclusion:
So, we finally completed all the security levels for the bWAPP Cross Site Scripting Reflected (AJAX-XML) Vulnerability. We looked into the various ways how application has been set up in various levels and how we can bypass the security controls implemented. Reflected-XSS attacks can be mitigated by performing input sanitization on endpoints, whitelist the allowed characters in the input and using a WAF. Along with that, we can prevent data from any untrusted source to be dynamically written to the HTML document. On that note, i will take your leave and will meet you in next one with another bWAPP vulnerability writeup, till then “Keep Hacking”.
